This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Cookie Policy. Click Preferences to customize your cookie settings.
Several subnetworks through the tunnel between Palo Alto and Mikrotik
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- Discussions
- General Topics
- Several subnetworks through the tunnel between Palo Alto and Mikrotik
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Printer Friendly Page
Several subnetworks through the tunnel between Palo Alto and Mikrotik
Options
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-22-2020 01:03 AM
Site 2 site allows only two networks to be pulled inside the tunnel (one of them behind the mikrotik and the other one behind the palo alto).I’ve tried different settings and it doesn't help.
Has anyone had experience building a tunnel between them based on GRE tunnel over IPsec?
Several subnetworks need to be passed through the tunnel.
7 REPLIES 7
Options
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-23-2020 08:15 AM
Hello,
Make sure the policies on the PAN are set to log at session end. On the PAN, are the routes to the 172 networksi n the virtual router and pointed at the Tunnel? Also in order for the PAN interface to respond to pings, it must have a management profile attached to it that allows PING.
Regards,
Options
- Mark as New
- Subscribe to RSS Feed
- Permalink
10-26-2020 06:41 AM
Hello/
In the rules, there is a permissive rule from this zone to the lan zone. Then, as a test, I added it to the LAN (LOCAL) zone where all traffic is allowed inside.
Yes, there is a route to the network through the tunnel.
Added MNG profile trust (ping allow) on the tunnel.
Options
- Mark as New
- Subscribe to RSS Feed
- Permalink
11-09-2020 06:47 AM
Previously, I set up a tunnel between a cisco router and a PA.
IPsec Site-to-Site VPN Palo Alto <-> Cisco Router w / VTI cc
They used a virtual tunnel interface (VTI) in a cisco router.
Drawing an analogy, I tried to collect between PAlo alto and Mikrotik.
As you know, on microtik you need to separately create a GRE interface, and then apply IPSEC.
I tried creating a loopback on it to hang the address on it.
Then I made the settings for IPSEC, and added a route.
Below I am attaching screenshots of both of the devices with settings.
I encountered an error in the IPSEC settings, it does not allow unchecking the Tunnel checkbox.
Instead, it issues an error message "Couldn't change IPSEC Policy - transport mode policy must match sa endpoints".
If you enter the IPSec settings:
Peer Address - 0.0.0.0/0
IPSec Policy- SA Dst. Address 0.0.0.0/0
It does not help.
In 'IPSec/Peer' set only remote peer, not local.
https://wiki.mikrotik.com/wiki/Manual:IP/IPsec
Tried changing policy settings - action , level, protocols. It does not help too.
Anybody have idea?
Like what you see?
Show your appreciation!
Click Like if a post is helpful to you or if you just want to show your support.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks